feat(oidc): add CreateOidcClientSheet component and update imports

- Introduced the CreateOidcClientSheet component for OIDC client creation.
- Updated the index export to include the new component.
- Modified the OIDC admin route to import and utilize the new CreateOidcClientSheet.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/lib/oidc/keys.ts

@@ -40,8 +40,26 @@ function publicJwkFromPrivateExport(jwk: JWK, kid: string): JWK {
 async function materialFromPem(
   kid: string,
   privatePem: string,
+  publicJwkJson?: string,
 ): Promise<OidcKeyMaterial> {
-  const privateKey = await importPKCS8(privatePem, 'RS256')
+  // jose defaults extractable=false for private keys → exportJWK throws
+  const privateKey = await importPKCS8(privatePem, 'RS256', {
+    extractable: true,
+  })
+
+  if (publicJwkJson) {
+    try {
+      const stored = JSON.parse(publicJwkJson) as JWK
+      return {
+        kid,
+        privateKey,
+        publicJwk: publicJwkFromPrivateExport({ ...stored, kid }, kid),
+      }
+    } catch {
+      // fall through to derive from private key
+    }
+  }
+
   const full = await exportJWK(privateKey)
   return {
     kid,
@@ -67,7 +85,11 @@ export async function ensureOidcSigningKey(
 
   const existing = getActiveOidcSigningKey(app.db)
   if (existing) {
-    cached = await materialFromPem(existing.kid, existing.privatePem)
+    cached = await materialFromPem(
+      existing.kid,
+      existing.privatePem,
+      existing.publicJwkJson,
+    )
     return cached
   }